When I logged on this morning I ran netstat -plant and found a couple
of established connections on port 22 from China and France.
How long did you see them for?
If you have an SSH server on the Internet, people are going to be constantly scanning for it and attempting dictionary attacks of common passwords. So systems will connect, try multiple passwords, and have enforced delays between tries as your system wants to limit brute force attacks.
All this means is TCP connections "established" for seconds or even minutes. They aren't authenticated SSH sessions, they're just TCP connections.
$ netstat -tn | grep :22 | egrep -v "[my address]"
tcp 0 1080 192.168.1.2:22 184.108.40.206:25690 ESTABLISHED
tcp 0 1 192.168.1.2:22 220.127.116.11:40117 FIN_WAIT1
a couple minutes later:
$ netstat -tn | grep :22
tcp 0 1080 192.168.1.2:22 18.104.22.168:48456 ESTABLISHED
In the first snapshot we see that there's one established session, and one still being torn down. A couple minutes later, there's a new session (notice the client port has changed to 48456). So this person is constantly opening a TCP connection, trying to authenticate, and when that connection gets shut down for too many tries they just open another one.
I find it hard to believe that a 4096 bit rsa key can be cracked
within the space of one evening.
Are there any exploits / vulnerabilities that can be used to
circumvent key-based authentication with OpenSSH?
Is key-based auth the best option to allow access with SSH? What are
Don't panic yet. Watch the connections; unless you see one last for a significant period of time you probably don't have to worry.
You can also check
last output to see if anyone is actually logging in, and correlate their source address (e.g., don't worry about logins from the IP you log in from):
gowenfawr pts/0 192.168.1.3 Thu Aug 3 18:55 still logged in
gowenfawr pts/0 172.16.43.21 Thu Aug 3 03:29 - 03:29 (00:00)
gowenfawr pts/0 172.16.43.21 Thu Aug 3 03:19 - 03:29 (00:09)
gowenfawr pts/0 172.16.43.21 Thu Aug 3 03:04 - 03:06 (00:02)
gowenfawr pts/1 192.168.1.3 Wed Aug 2 19:44 - 21:09 (01:25)
wtmp begins Wed Aug 2 19:44:26 2017
Although, of course, if someone did compromise your system, you couldn't trust